Mitigate secret argv exposure and harden remote include write boundaries - #48318

Merged

pelikhan merged 5 commits into

mainfrom

copilot/vulnhunter-fix-secret-exposure

Jul 27, 2026

Commits on Jul 27, 2026

Initial plan
Copilot
authored
6076a80
Fix secret argv exposure and include write boundary checks

Copilot
and
pelikhan
authored
ffcfb7a
docs(adr): add draft ADR-48318 for secret stdin delivery and include write boundaries
github-actions[bot]
authored
a3a3a70
Fix --body - flag in secret set calls and fix ValidatePathWithinBase symlink ancestor bypass

Copilot
and
pelikhan
authored
b92f0db
Thread ctx through uploadSecretToRepo, replace fetchIncludeFromSource global with parameter, add .. guard and nested traversal test

Copilot
and
pelikhan
authored
907fc4f